diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 58ff67c..48d4b7b 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -13576,17 +13576,17 @@
     {
       "description": "Ransomware delivered using fake Windows Update spam",
       "meta": {
-        "refs": [
-          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/"
-        ],
         "extensions": [
           ".777"
         ],
         "ransomnotes-filenames": [
           "Cyborg_DECRYPT.txt"
         ],
-        "ransomnotes-refs":[
+        "ransomnotes-refs": [
           "https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-pi"
+        ],
+        "refs": [
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/"
         ]
       },
       "uuid": "0a0b9311-8cbc-4d97-b337-42c9a018ebe0",